Bug 1986102 (CVE-2021-32786)

Summary:	CVE-2021-32786 mod_auth_openidc: open redirect in oidc_validate_redirect_url()
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aboscatt, jhrozek, puiterwijk, rschiron, spoore, thalman
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	mod_auth_openidc 2.4.9	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in mod_auth_openidc where it does not sanitize redirection URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-05-11 02:46:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1986103, 1987203, 1987204
Bug Blocks:	1986104

Description Guilherme de Almeida Suckevicz 2021-07-26 17:09:38 UTC

In versions prior to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way as most browsers do. As a result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout functionality. This bug has been fixed in version 2.4.9 by replacing any backslash of the URL to redirect with slashes to address a particular breaking change between the different specifications (RFC2396 / RFC3986 and WHATWG).

References:
https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-xm4c-5wm5-jqv7
https://daniel.haxx.se/blog/2017/01/30/one-url-standard-please/
https://github.com/zmartzone/mod_auth_openidc/releases/tag/v2.4.9

Upstream patch:
https://github.com/zmartzone/mod_auth_openidc/commit/3a115484eb927bc6daa5737dd84f88ff4bbc5544

Comment 1 Guilherme de Almeida Suckevicz 2021-07-26 17:09:52 UTC

Created mod_auth_openidc tracking bugs for this issue:

Affects: fedora-all [bug 1986103]

Comment 3 Riccardo Schirone 2021-07-29 08:28:41 UTC

Upstream they suggested as a workaround to configure configuring `mod_auth_openidc` to only allow redirection whose destination matches a given regular expression, through the use of OIDCRedirectURLsAllowed, however that feature was only introduced in upstream version of mod_auth_openidc 2.4.3. The latest version of mod_auth_openidc as shipped in Red Hat Enterprise Linux 7 and 8 is older than 2.4.3 and it does not support OIDCRedirectURLsAllowed, thus no mitigation can be applied on those systems.

Comment 5 errata-xmlrpc 2022-05-10 13:39:52 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:1823 https://access.redhat.com/errata/RHSA-2022:1823

Comment 6 Product Security DevOps Team 2022-05-11 02:46:25 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-32786